[klee-dev] covering malloc error handlers

[Sven]

hey there,

Can klee generate path for failed mallocs?

I am running:

#include <stdlib.h>

int main(int argc, char **argv) {
        char *c = malloc(6*sizeof(char));
        if(NULL == c) {
                return 1;
        }
        return 0;
}

I expect 2 pathes, one where malloc fails, and thereby returns NULL, and
one where malloc is successful. However, I am getting just one path. Is
this a limitation of klee or am I doing something wrong?

Cheers,
Sven